This is the next step in resolving #103699. It aims to replace construction of HTML elements by string concatenation with DOM API calls in all of the simple cases (i.a. when the text content of the element is not rendered in any special way eg. with codicons).
For example:
Replace
this._domNode.innerHTML = ‘<span>no commands</span>’;
with
this._domNode.innerText = ‘’;
this._domNode.appendChild(createHTMLElement<HTMLSpanElement>(‘span’, ‘no commands’);
This is ~10% of all of the issues discovered with tsec.
+@koto @engelsdamien